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ABSTRACT 


Police officers are often the targets of threats, both verbal and written. Twitter and 
Facebook allow the communications of these threats quickly, anonymously and in high 
volume. Law enforcement agencies become overwhelmed trying to determine which are 
the most serious, since they have limited investigators. Identifying threats that have a 
high likelihood of violence is also very subjective. How can risk assessment of these 
threats be improved? As an answer to this question, a software-requirement specification 
document details a new software that starts the threat assessment process earlier. This 
software incorporates a social media and language sentiment analyzer, criminal history 
information and threshold, and confidence scoring to alert law enforcement of threats 
likely to end in violence. Twitter and Facebook posts that reach a predetermined score 
alert investigators of a high probability threat on which investigators can focus their 
efforts. During the development of the software proposal, this thesis finds that 
implementing this software could improve law enforcement intervention to threats 
communicated over social media. 
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EXECUTIVE SUMMARY 


Police officers are often the subjects of threats. Investigations of these threat cases 
follow a framework similar to one published in 2006 by the Association of Threat 
Assessment Professionals (ATAP).' The framework provides behavioral indicators and 
risk factors gleaned from information of a known suspect, which is analyzed and applied 
during threat management activities. Nevertheless, since the publication of that 
framework in 2006, the volume of threats to law enforcement personnel through social 
media—notably Facebook and Twitter—has increased. Whereas people once handwrote 
threats, they now simply send messages from their phones or computers. The ease and 
instant connectivity of social media means a much higher volume of threats than before, 
which taxes law enforcement’s ability to investigate each one. 

Complicating the investigation is the fact that not every threat is a real one. 
Calhoun and Weston divide threateners into two categories, hunters and howlers, 
demonstrating that not all threats lead to violent acts. The internet magnifies the ability 
of people to communicate threats, but very few are carried out. Determining which 
threats are real is difficult. First of all, Twitter and Facebook provide a platform of 
communications that can hide someone’s identity. Obtaining the identity of a Twitter 
account holder requires court paperwork based on probable cause or exigent 
circumstances. Second, social media allow people to repost tweets from the original 
threatener, whereby the same threat appears to originate from many different people. In 
this case, it is difficult to identify which poster poses the highest risk of violence. 

Analyzing the language of Twitter and Facebook posts could provide an earlier 
starting point. Patton et al. illustrate how language from Twitter messages can be coded 


^ Association of Threat Assessment Professionals, Risk Assessment Guideline Elements for Violence: 
Considerations for Assessing the Risk of Future Violent Behavior (Sacramento, CA: Author, 2006), 
https://c.ymcdn.com/sites/www.atapworldwide.org/resource/resmgr/imported/documents/RAGE-V.pdf 

^ Association of Threat Assessment Professionals, 5. 

^ Frederick S. Calhoun, and Stephen W. Weston, Concepts and Case Studies in Threat Management 
(Boca Raton: CRC Press, 2013), 11, http://www.crcnetbase.com.hbproxy.nps.edu/isbn/9781439892183. 
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for different types of aggression—direet, indirect, proactive, and reactive.'^ The coding 
method is not used to assess risk. Coding Twitter messages also occurs in the private 
sector. Automated analysis of social-media language can identify risks to a company’s 
reputation through a coding process.^ By coding text, analysts can divide tweets into 
negative or positive feelings about the company.^ Progressing even further, confidence 
scoring provides a ranking based on how probable an event is to happen.^ Using this tool 
could also help determine which threats have a higher probability of happening. Lastly, 
tools such as public record databases, search engines and social media analysis software 
exist which could analyze information provided in threatening posts, feed information to 
the confidence scoring tool and possibly increase the accuracy of confidence. 

In sum, risk assessments begin at the point a suspect is identified. The evolution 
of social networking sites allows individuals to communicate threats anonymously and in 
high volume. This ability means investigators cannot wait to identify a suspect to begin a 
risk assessment. There are software tools already available that can help start assessments 
earlier. By creating a new software platform that combines a social media monitoring 
tool, a language sentiment tool, a criminal history database and a confidence scoring tool, 
law enforcement identifies violent people before they injure or kill their victims. 
Although more development is needed, the case stories in this thesis shows the proposed 
software correctly identifying people that post on social media and then act out violently. 


Desmond U. Patton et al., “Gang Violence on the Digital Street: Case Study of a South Side Chicago 
Gang Member’s Twitter Communication,” New Media & Society (January 2016): 7, doi: 
1461444815625949. 

^ Paul Alpar, and Daniel Ohliger, “Creation of Risk Profiles of Business Customers from Social 
Media,” Banking and Information Technology 16, no. 1 (March 2015): 26, 

http://web.a.ebscohost.com.libproxy.nps.edu/ehost/pdfviewer/pdfviewer?sid=a77475c8-66bb-44f6-9007- 

565450b5762d%40sessionmgr4007&vid=l&hid=4214. 

^ Alpar and Ohliger, 26. 

^ Bill Murdock, “How to select a threshold for Acting Using Confidence Scores,” IBM Watson, June 
23, 2016,https://developer.ibm.com/watson/blog/2016/06/23/how-to-select-a-threshold-for-acting-using- 
confidence-scores/. 
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1. THREAT INVESTIGATIONS NEED TO CHANGE 


A. RESEARCH QUESTION 

This thesis answers the following question; How can we improve risk assessment 
used by law enforcement on threats communicated over Twitter and Facebook? 

B. PROBLEM STATEMENT 

February 29, 2016 

The day began like any other day for us at the Raleigh Intelligence Center. 

Normal for us is juggling the constant influx of requests from various 
district captains and officers while we also complete our regular crime 
analysis products. The craziness came to a sudden stop as we heard an 
officer on the radio call out a foot pursuit, followed by silence. When 
back-up finally arrived to help the officer, radio traffic conveyed that the 
suspect had been killed by the officer during a struggle over a gun. Soon, 
the news monitors showed an increasingly tense scene: the streets filled 
with people pushing the crime-scene tape as far in as they could before it 
broke, yelling and pointing fingers at the cops who stood stoically and 
expressionless behind the tape. 

Before our eyes, the events of February 29 unfolded on network news, and 
push notifications from social media flooded our detectives’ monitors. 

Live video from the scene flowed in, and as the investigation wrapped up, 
protest groups began streaming videos and posting messages over Twitter 
and Facebook. Later that day, social media advertised vigils and meetings 
to organize civil protests. Some of these messages spewed hatred at the 
police. 

The next day, the department released the name of the officer. Posts filled 
with anger turned into threatening statements directed at the police. One 
Twitter post read, “Fuck Twiddy [the officer]. Sumbody needa kill his wife 
nd kids, make his ass feel it!!! ” Comments and reposts of these tweets 
gave them a life of their own. If you printed off every social media page 
that contained a threat or a repost of a threat, we would have had a stack 
three feet tall. Tasked with assessing threats by over 60 different people, 
our team had to find a new way. We didn ’t have enough investigators to 
investigate each one immediately. We weren’t even sure whether they 
were all real, especially since some people had simply reposted others’ 
threats. How could we sort through the posts and identify the highest risk 
posts? 
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Police officers are often the subjects of threats. Investigations of these threat cases 
follow a framework similar to one published in 2006 by the Association of Threat 
Assessment Professionals (ATAP).' The framework provides behavioral indicators and 
risk factors gleaned from information of a known suspect, which is analyzed and applied 
during threat management activities. Nevertheless, since the publication of that 
framework in 2006, the volume of threats to law enforcement personnel through social 
media—notably Facebook and Twitter—has increased. Whereas people once handwrote 
threats, they now simply send messages from their phones or computers. The ease and 
instant connectivity of social media means a much higher number of threats than before, 
which taxes law enforcement’s ability to investigate each one. 

Complicating the investigation is the fact that not every threat is a real one. 
Calhoun and Weston divide threateners into two categories, hunters and howlers, 
demonstrating that not all threats lead to violent acts. The internet magnifies the ability 
of people to communicate threats, but very few threats are carried out. Determining 
which threats are real is difficult. First of all, Twitter and Facebook provide a platform of 
communications that can hide someone’s identity. Obtaining the identity of a Twitter 
account holder requires court paperwork based on probable cause or exigent 
circumstances. Second, social media allow people to repost tweets from the original 
threatener, whereby the same threat appears to originate from many different people. In 
this case, it is difficult to identify which poster poses the highest risk of violence. 

Assessing the risk of violence begins at the point a suspect is identified."^ An 
aspect of typical risk-assessment protocols suggests interviewing the threatening subject. 
Borum et al. provide an example of these protocols in their list of ten questions to answer 

1 Association of Threat Assessment Professionals, Risk Assessment Guideline Elements for Violence: 
Considerations for Assessing the Risk of Future Violent Behavior (Sacramento, CA: Author, 2006), 
https://c.ymcdn.com/sites/www.atapworldwide.org/resource/resmgr/imported/documents/RAGE-V.pdf 

^ Association of Threat Assessment Professionals, 5. 

^ Frederick S. Calhoun and Stephen W. Weston, Concepts and Case Studies in Threat Management 
(Boca Raton: CRC Press, 2013), 11, http://www.crcnetbase.com.hbproxy.nps.edu/isbn/9781439892183. 

^ Robert A. Fein and Bryan Vossekuil, Protective Intelligence and Threat Assessment Investigations: 

A Guide for State and Local Law Enforcement Officials (Washington, DC: U.S. Department of Justice, 
1998), 24. 
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during assessments. Answering the questions requires tasks such as surveillance on the 
threatener and interviews with neighbors and friends.^ Steps like these obviously require 
waiting until the identity of the threatener is known. Working on identifying suspects so 
an investigation can begin does not stop new threats and reposts of older threats, possibly 
breaking down a threatener’s inhibitions for violent speech, but not for true violence.^ 
Thus, waiting to start risk assessments is no longer acceptable. Providing security while 
identifying a suspect requires the use of limited resources. The ability of Twitter and 
Facebook to communicate to a large group of people quickly, possibly gaining a 
community of support, means law enforcement needs a new way to begin assessing the 
risk of violence sooner. 

Analyzing the language of Twitter and Facebook posts could provide an earlier 
starting point. Patton et al. illustrate how language from Twitter messages can be coded 
for different types of aggression—direct, indirect, proactive, and reactive.^ The coding 
method is not used to assess risk. Coding Twitter messages also occurs in the private 
sector. Automated analysis of social-media language can identify risks to a company’s 

o 

reputation through a coding process. By coding text, analysts can divide tweets into 
negative or positive feelings about the company.^ Progressing even further, confidence 
scoring provides a ranking based on how probable an event is to happen. Using this tool 
could also help determine which threats have a higher probability of happening. Lastly, 


^ Randy Borum et al., “Threat Assessment: Defining an Approach to Assessing Risk for Targeted 
Violence,” Behavioral Sciences & the Law 17, no. 3 (September 1999): 331-335, doi: 10.1002/(SICI)1099- 
0798(199907/09)17:33.0.CO;2-G. 

^ “Online Disinhibition Effect (Suler),” Learning Theories, December 15, 2015, https://www.leaming- 
theories.com/online-disinhibition-effect-suler.html. 

^ Desmond U. Patton et al., “Gang Violence on the Digital Street: Case Study of a South Side Chicago 
Gang Member’s Twitter Communication,” New Media & Society (January 2016): 7, doi: 
1461444815625949. 

^ Paul Alpar and Daniel Ohliger, “Creation of Risk Profiles of Business Customers from Social 
Media, ” Banking and Information Technology 16, no. 1 (March 2015): 26, 

http://web.a.ebscohost.com.libproxy.nps.edu/ehost/pdfViewer/pdfviewer?sid=a77475c8-66bb-44f6-9007- 

565450b5762d%40sessionmgr4007&vid=l&hid=4214. 

^ Alpar and Ohliger, 26. 

Bill Murdock, “How to select a threshold for Acting Using Confidence Scores,” IBM Watson, June 
23, 2016,https://developer.ibm.com/watson/blog/2016/06/23/how-to-select-a-threshold-for-acting-using- 
confidence-scores/. 
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tools such as public record databases search engines and soeial media analysis softwares 
exist whieh eould analyze information provided in threatening posts, feed information to 
the eonfidenee seoring tool and possibly inerease the accuraey of eonfidenee. 

In sum, risk assessments begin at the point a suspeet is identified. The evolution 
of soeial networking sites allows individuals to eommunieate threats anonymously and in 
high volume. This ability means investigators cannot wait to identify a suspeet to begin a 
risk assessment. There are software tools already available that can help start assessments 
earlier. By ereating a new software platform that eombines a soeial media monitoring 
tool, a language sentiment tool, a eriminal history database and a eonfidenee seoring tool, 
law enforeement identifies violent people before they injure or kill their vietims. 
Although more development is needed, the ease stories in this thesis shows the proposed 
software eorreetly identifying people that post on soeial media and then aet out violently. 

C. LITERATURE REVIEW 

Researehing the topie of threat assessments led to artieles in professional journals, 
guides by the Department of Justiee, as well as peer-reviewed publieations. Mueh of the 
material is deeades-old; some publieations date baek to the late ‘90s. As a result, the 
publieations do not diseuss threats over Twitter and Faeebook. However, publieations by 
the business, eommunication, and eomputer-seience fields do diseuss risk assessments in 
the eontext of Twitter and Faeebook. Expanding the search to fields outside the eriminal 
justiee profession necessitates breaking this literature review into three areas: threat 
assessments, soeial-media eommunieation, and risk assessment methods. The first seetion 
ineludes seholarly publieations from the 90s on threat assessment models. These models 
eome from the field of psyehology and fit into olinieal assessment praetiees. The 
psyehology of soeial-media audienees sets up the seeond seetion for aeademies to diseuss 
how Twitter and Faeebook make it easier for suspeets to threaten others. The third 
seetion explores assessments of written terrorist and suieide threats as well as risk 
assessments in business. Researeh done on these subjects may help update the standards 
law enforeement eurrently uses. 
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1 . 


Threat Assessments in Law Enforcement 


Scholars write about threat assessments for use in a wide variety of threat 
environments. Cornwell et al. provide guidelines for assessing threats in the edueation 
field, Neben applies threat assessment models to lone-wolf terrorists, and Patton et al. 
analyze threats among gang members." This seetion narrows the seope to threats against 
law enforeement. Narrowing the seope allows the discussion of threat assessment guides 
used by law enforcement as well as the psyehology behind threats. 

While working for the Seeret Serviee, Fein and Vossekuil ereated a threat- 
assessment guide for law enforeement. The U.S. Department of Justiee published Fein 
and Vossekuil’s guide as a referenee for law enforeement officers tasked with 
investigating threats. This exemplar provides deseriptions of assassin behavior, 
elements of a threat assessment program, and guidanee for eondueting threat 
assessments.^"^ In 1999, these authors joined Borum and Berglund to produee an aeademie 
work for the behavioral seienee field, outlining questions to answer during a threat 
assessment." The ten questions developed in their artiele form a behavioral approaeh to 
assessments, which has earned the seholars frequent aeknowledgments by academies and 
practitioners alike." The questions help explain behavior—the subjeet’s interest in 
violenee, his communieation of intentions for violenee to friends and family, and his 
engagement in aetions considered preeursors to violence sueh as stalking. 

Calhoun and Weston are two other authors frequently refereneed in threat- 

17 

assessment literature. Their work, influeneed by experienee helping the U.S. Marshal 

11 Rachel V. Neben, “Effectiveness of Threat Assessment Models for Lone Terrorists,” Small Wars 
Journal 13, no. 7 (August 2015): http://smallwarsjoumal.com/jmFart/effectiveness-of-threat-assessment- 
models-for-lone-terror; and Patton et al., “Gang Violence on the Digital Street.” 

Fein and Vossekuil, Protective Intelligence. 

12 Robert A. Fein, Gwen A. Holden, and Bryan Vossekuil, Threat Assessment: An Approach to 
Prevent Targeted Violence (Washington, DC: U.S. Department of Justice, 1995), 
https://www.hitacllc.com/HlTAC_Resources/ThreatAssessmentApproachtoTargetedViolence.pdf 

1“^ Fein, Holden and Vossekuil, 3-4. 

1^ Boram et al., “Threat Assessment,” 331-335, 

16 Bomm et al., 331-335. 

12 Frederick S. Calhoun and Stephen W. Weston, Concepts and Case Studies in Threat Management 
(Boca Raton: CRC Press, 2013), 1, http://www.crcnetbase.com.hbproxy.nps.edu/isbn/9781439892183. 
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Service and the California Highway Patrol investigate threats to government officials, 
describes a pathway to intended violence, which includes the stages of grievance, 
ideation, research and planning, preparation, breach, and attack. Calhoun and Weston 
introduce the theory of “howlers and hunters as they discuss the movement from 
grievance to attack.”'^ Howlers are satisfied with just communicating threats. Most of the 
time, they do not leave the ideation stage on the pathway; the thought of violence is 
enough to satisfy them. Hunters quickly move down the path. There is no threat 
communication, and suspects reach the attack stage. This theory helps explain why 
some people threaten and others attack without warning. The theory does not rule out 
threateners as attackers. Although Calhoun and Weston updated their book in 2013, it 
does not discuss threats via Facebook and Twitter. This lapse by prominent authors 
shows the need to update threat assessment research. 

2. Social Media Communication 

Social-media literature dates back to when email and blogs were the main form of 
communication over the internet. In a 2016 article. Carpenter and Lertpratchya discuss 
general communication over current social-media platforms such as Twitter and 
Facebook. They create a model illustrating social media as a “customer service 

94 

provider, mobilizer, information disseminator, researcher, and community builder.” 
Carpenter and Lertpratchya expand on the community builder role, describing how social 

25 

media is malleable to fit individual needs to connect them to their online community. 
The community-builder role shows up in other research as academics discuss the effects 
of social media on people’s lives. 

Calhoun and Weston, Concepts and Case Studies, 10. 

1 ^ Calhoun and Weston, 11. 

Calhoun and Weston, 10-11. 

Calhoun and Weston , 11-12. 

22 Calhoun and Weston. 

23 Serena Carpenter and Alisa P. Lertpratchya, “Social Media Communicator Roles: A Scale,” Social 
Media + Society 2, no. 1 (January-March 2016): doi:10.1177/2056305116632778. 

24 Carpenter and Lertpratchya, 1. 

23 Carpenter and Lertpratchya, 7. 
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Dijck and Poell describe how social media platforms are pervasive in people’s 
lives. Health care, education, and even civil protests all use social media. Dijck and 
Poell along with Shephard et al. discuss the growth and sustainability of political action 
spawned over social media while discussing topics such as “cloud protesting” and “hate 
speech.”^^ The barrier to protesting and hate speech is lowered on social media because it 
provides a level of anonymity that lowers inhibitions. This effect ends up a subject of a 
roundtable discussion on the topic of spreading hateful speech throughout a community 
over social media. Masur and Scharkow write that social media “connects people, 
applications and business.This ability to bridge people leads to a discussion of the 
level of relationships individuals believe they have on social media and how it drives 
their perception on privacy of their posts. Twitter and Facebook make it difficult to 

32 

keep different social groups from overlapping and to control content between them. 

For another roundtable, academics in the fields of communications and media 

33 

discuss the pervasiveness of social media. Shepherd et al. discuss how hate has evolved 
online.They emphasize how easy it is to post hate speech and threats online versus in 
person. The participants also suggest how difficult it is to determine what language ends 
in violence. Part of this difficulty is in the varying interpretations of language in a 

Jose van Dijck and Thomas Poell, “Social Media and the Transformation of Public Space,” Social 
Media + Society 1, no. 2 (2015): 1, doi: 10.1177/2056305115622482. 

van Dijck and Poell, 1. 

van Dijck and Poell, “Social Media and the Transformation of Public Space,” 3; and Tamara 
Shepherd et al., “Histories of Hating,” Social Media + Society 1, no. 2 (July-December 2015): 1, 
doi:10.1177/2056305115603997. 

Shepherd et al., “Histories of Hating,” 1-10. 

Philipp K. Masur and Michael Scharkow. “Disclosure Management on Social Network Sites: 
Individual Privacy Perceptions and User-Directed Privacy Strategies.” Social Media+ Society 2, no. 1 
(2016): l,doi: 10.1177/2056305116634368. 

31 Masur and Scharkow, 3. 

32 Yumi Jung and Emilee Rader, “The Imagined Audience and Privacy Concern on Facebook: 
Differences Between Producers and Consumers.” Social Media + Society 2, no. 2 (2016): 1, 
doi:10.1177/2056305116644615. 

33 Shepherd et al., “Histories of Hating.” 

34 Shepherd et al., 1. 

33 Shepherd et al., 2. 

3^ Shepherd et al., 5. 
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'in 

post. While Sheppard et al. diseuss hate and threatening speech on social media, their 

38 

discussion does not provide answers for assessing the threats. 

Patton et al. do propose a method for assessing threats communicated over 

-5 0 

Twitter. This limited study concentrates on threatening communication among gang 
members in Chicago, leading to the death of a gang member named Tyquan Assassin."^® 
Tweets from a two-week period surrounding her death were coded into categories of 
violence such as direct threats of violence and indirect threats of violence."^' Patton et al. 
show that Twitter messages convey geographical information for locations of violence as 
well as the mechanism for that violence."^^ 

3. Risk Assessment Methods 

Research on threats communicated over social media fails to address threat 
assessments over Twitter and Facebook in the law-enforcement community. In an attempt 
to gather information to address the deficiency, literature on evaluating risk in the 
language of suicide notes, the written words of terrorist communications and social media 
language directed at businesses is explored. 

Handleman and Lester use linguistic inquiry and word-count analysis programs in 
their study of suicide notes."^^ Their methods looked at documents word-for-word and 
analyzed the text against 70 different aspects."^"^ They find the words people choose can 
show distress as well as feelings of inclusion or exclusion from their social groups."^^ The 
ability to look at written language for these signs may identify people needing help prior 


Shepherd et al., 4-5. 

Shepherd et al., 5. 

Desmond U. Patton et al., “Gang Violenee on the Digital Street,” 6. 

Patton et al. 

Patton et al., 7. 

Patton et al., 12. 

Lori D. Handleman and David Lester, “The Content of Suieide Notes from Attempters and 
Completers,” Crisis 28, no. 2 (2007): 102, doi:10.1027/0227-5910.28.2.102. 

Handleman and Lester, 102. 

Handleman and Lester, 104. 
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to committing suicide."^^ The ability to apply this method to Twitter posts still needs 
evaluation. 

Literature on terrorist eommunieation uses a different method to evaluate threats. 
Value referenees, words ehoiee showing how someone values something, in written 
eommunieation are the center of eommunieation research in this field. Smith et al. 
investigate how word choice demonstrates terrorist groups feelings about adversaries."^^ 
Value references within written eommunieations of terrorists reveal whieh terrorist 
groups are closely assoeiated as well as which groups are outcasts. This method of word 
analysis requires ending and rating of the doeument."^^ 

The business field also uses ending language. Literature in this field focuses not 
on violenee but on the effects of reputation. Sipior et al. postulate that businesses focus 
on social media’s positive effeets.^** A number of articles spanning the disciplines from 
business to eommunieations diseuss the use of soeial media to improve a eompany’s 
reputation.^' However, the aeademies do not eonsider the risk of soeial media to a 
eompany’s reputation. Stepashkin and Khusnolarov present a way to begin analyzing 
risk to reputation through an automated proeess. Their proeess involves establishing a 
speeial language based on semantic categories and lexieons.^"' Onee the language is 

Handleman and Lester, 104. 

Allison Smith, “From Words to Aetion: Exploring the Relationship between a Group’s Value 
Referenees and Its Likelihood of Engaging in Terrorism,” Studies in Conflict and Terrorism, 27, no. 5 
(2004): 409, doi: 10.1080/10576100490483679. 

48 Smith., 412-413. 

49 Smith, 420. 

Janiee C. Sipior, Burke T. Ward, and Linda Volonino. “Benefits and Risks of Soeial Business: Are 
Companies Considering E-Diseovery?.” Information Systems Management 31, no. 4 (Fall 2014): 328, 
doi:10.1080/10580530.2014.95803L 

Mark Brinkley, “Soeial Media Risk.” Internal Auditor 71, no. 2, (April 2014): 68- 69, 
http://web.a.ebseohost.eom.libproxy.nps.edu/ehost/detaiFdetail?sid=2b2ef9a3-el43-4905-8609- 
a6e06b9b3d8d%40sessionmgr4007&vid=0&hid=4209&bdataHnNpdGU9ZWhve3QtbG12ZSZzY29wZTl 
zaXRl#db=bth&AN=l00244213; and Sipior et al., “Benefits and Risks of Soeial Business.” 

Sipior et al., 331. 

M.V. Stepashkin and F.F. Khusnolarov, “Risk Analysis for Reputation Based on Assessments and 
Ranking of Information Events and Speeifle Data from Open Sourees of Information.” Problems of 
Economic Transition 57, no. 12, (2015): 8, doi:10.1080/10611991.2015.1161443. 

^4 Stepashkin and Khusnolarov, 11. 
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established, the researehers ereate templates for groups of oommunieations.^^ These 
templates help divide the language into positive, negative, and neutral eategories.^^ 
Finally, people trained on their eoding system assess the faet a seeond time, providing 
eonhrmation.^^ Stepashkin and Khusnolarov do not diseuss the aeeuraey of the 
meehanism.^^ 

4. Conclusion 

The use of soeial media as a venue to eommunieate threats is a relatively new 
held of study. Therefore, researeh on assessing threats delivered over soeial-media 
platforms, sueh as Twitter and Faeebook, is still eatehing up. While the literature eovers 
teehniques that are useful in assessing and mitigating threats, speeihe applieations to 
eommunieations over soeial media is not adequately eovered. The ease study by Patton et 
al. on gang eommunioations over Twitter and Faeebook provides a starting point and a 
methodology of induetive textual analysis that is useful for eoding violenee.^^ 

D. RESEARCH DESIGN 

Twitter and Faeebook allow the eommunieation of threats quiekly, anonymously 
and in high volume. This presents a situation where law enforeement has a large number 
of threats to investigate. Current methods for assessing the risk from a threat start at the 
point an individual are identihed. This means investigators sort threats by ease of 
identiheation instead of risk for violenee. Prioritizing threat investigations by intuition 
alone eould lead to not investigating a threat, resulting in a vietim being injured or killed. 
Currently, there is not a better way to prioritize the threats. If a suspeet is not known, the 
language of the post is the only avenue available to determine risk of violenee. 
Researehing whether a model applied against the language of Twitter and Faeebook posts 
ean determine the eonfidenee of a threat happening may allow investigators to eorreetly 

Stepashkin and Khusnolarov, 11. 

Stepashkin and Khusnolarov, 11. 

Stepashkin and Khusnolarov, 11. 

Stepashkin and Khusnolarov, 15. 

Patton et al., “Gang Violenee on the Digital Street,” 6. 
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prioritize investigations. This eould help prevent injury or death to vietims of violent 
threats. 

This thesis aims to propose the model that ean start assessing the risk of threats 
eommunieated over soeial media before a suspeet is identified. The proposed model 
being assessed eombines software platforms already used by law enforeement and 
assesses how they ean eombine with software known as eonfidenee seoring to automate 
analysis and provide a eonfidenee of oeeurrence for threats. Software requirement 
speeifieations used in the proposal follow IEEE 830 -1998 format. IEEE 830-1998 is the 
reeommended format for eommunieating software requirements. The paper also 
eompares eurrent investigative praetiee against the proposed software in threat 
investigation and demonstrates how this model ean be implemented and enhances threat 
investigations. This comparison is enhanced through exploration of four case stories. 
Each story walks the reader through how investigations manually make case decisions. In 
a later chapter, the step within the proposed software evaluates the same case stories and 
illustrates how the software aids investigations. 

The research design sets up an intuitive progression for this paper. Chapter II 
explains how current investigators work social media threat cases. After the explanation 
of the investigation method, four case studies show how detectives apply the steps. 
Chapter III then describes how the proposed software works threat investigations. This is 
accomplished through completed a software requirement specification document that 
becomes chapter III. Once the explanation is complete, the same previous case studies 
show how the way social media threats investigations improve. While new software to 
help improve investigations is encouraging, the development does not come without areas 
of consideration. Chapter IV explores implementation and design obstacles and wraps up 
with the thesis conclusion. Upon this conclusion, this thesis hopes to demonstrate an area 
for future research in how coding language can change to allow each to work together in 
a user friendly product. 
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II. CURRENT INVESTIGATIVE METHOD 


Threats over soeial media ereate a situation whereby multiple threats can be 
communicated anonymously. While assessing these threats starts at discovery, and 
includes deciding on protective measures for the victim, efforts of investigators center on 
identifying the suspect. The steps to identifying the poster take time and force 
investigators to use their best judgement for what order they investigate the threats. The 
order investigators chose to investigate cases can end with more serious ones being 
overlooked. The following sections illustrate how investigators verify a threat and search 
for suspect identification in order to complete a risk assessment. 

A. THE MANUAL INVESTIGATIVE PROCESS 

When a threat is identified on Twitter or Facebook, it is assigned an investigator. 
The investigator’s first step is to verify that the message is a threat. He then begins the 
process of identifying a suspect. If the threat is posted with the public privacy setting, the 
investigator can go directly to the online post. The investigator can access the user name 
for the account which is sometimes the user’s real name and sometimes a fake name. 
Accounts with fake user information or whose security is set to private require the 
investigator to appear before a judge for a court order. If the judge issues an order, it 
mandates that Twitter or Facebook preserve the posts and handover account information 
to the law enforcement investigator. This process takes time to write the court affidavits, 
secure a judge’s signature, submit the order to Twitter or Facebook, and wait hours or 
days for the social media provider to send the requested information. 

Twitter or Facebook may only provide fake information. Additional court orders 
or search warrants may compel Twitter and Facebook to provide internet protocol (IP) 
address information for the threatening post. This second court orders provide a name for 
the internet provider. A third court order or search warrant is then submitted to that 
internet provider requiring them to provide the location of the IP address. Database 
research by the investigator may reveal a suspect living at the address. Surveillance of the 
address may assist in suspect identification. A search of the address after obtaining a 
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search warrant or interviewing the occupants of the address may lead to the identity of 
suspects. If a suspect is identified, a risk assessment can begin. 

Even if a suspect is identified quickly, during times of high threat volume, 
investigators must decide which threats to put limited manpower toward. There is no 
standardized guidance for how to make these decisions. The four case studies that follow 
analyze two cases the Raleigh Police Department investigated during an officer involved 
shooting incident in February 2016 and two cases that happened over a year later and 
each from different jurisdictions. 

B. CASE STORIES 

In this section, three posts are examined through the lens of three criteria: social 
media language, the identity and criminal background of the poster, and the statutory 
requirements to deem the post a threat. Each case includes the language for the posted 
conversational thread and discusses how the language, the criminal background of the 
poster and criminal statutes are used to evaluate the post for a threat. The authors of the 
first two case studies posted their comments in open source; however, due to the 
investigations of their cases not ending in criminal charges, their names are changed to 
protect their privacy. These first two studies also originate from among 22 cases that 
investigators worked during the February 2016 incident. The last two studies stand alone 
and are from separate jurisdictions with one originating in Washington, D.C., and the 
other from New York City. The language for case story three and four come from media 
sources. 

Expletives remain written as they were in these news stories. The original spelling 
and punctuation of each social media was unchanged from the original. 

1. Facebook Post against Officer Twiddy 

In February 2016, a Raleigh Police officer shot a suspect during a struggle. 
Shortly after the incident, people from the community started posting on Facebook and 
Twitter. A lot of these posts talked negatively about the police. Other posts 
communicated threats toward law enforcement. This case study is taken from a Facebook 
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post made after the shooting. The person posting was identified and referred to here as 
B.K. He posts the following comment: 

Im sorry I don’t normally think about this but peaceful protesting? For 
what? For them to continue to take us African Americans as a joke. I may 
be wrong but the way I’m feeling it’s time to shoot some of they kind 
down too. We always talk about other cities going through what we going 
through && what we would do. I’m going to support my city 100% RIP 
Lockman.^*’ 

This post is followed by a comment from another subject wanting peaceful protests in his 
neighborhood, so neighbors’ houses and kids do not get shot. B.K. replies to this 
individual with 

Ain’t nobody thinking about shooting up nobodies house or kids....I said 
shoot some of their kind down not go shoot up houses and kill kids.^' 

B.K. then posts on his Facebook page a picture of two t-shirts, one reading “Fuck a cop 
named Twiddy” and the other “100 to 500 RIP Lock AKA.”^^ 

a. Social Media Language 

The language in this post expresses direct violence against law enforcement 
officers, and the direct action was to shoot officers. When faced with a poster asking for 
peaceful protest, B.K. continues with the threat of violence. B.K. then posts pictures of t- 
shirts naming a specific officer and encouraging people to load an “AKA,” an assault 
rifle. Moreover, this post appeared during a period when the community was already 
protesting the shooting of a black male by the police. B.K. did fall into the howler 
definition in that he posted in anger. Most howlers do not turn to violence, but since his 
claims were specific and communicated more than once, B.K. warranted a closer look. 


B. K. Facebook page, accessed March 1, 2016, 
https ://facebook.com/prfile.php?id=100010733497326&fref=ts. 

B. K. Facebook page, https://facebook.com/prfile.php?id=100010733497326&fref=ts. 

B. K. Facebook page, https://facebook.com/prfde.php?id=100010733497326&fref=ts. 
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b. Criminal Background 

Once the poster is identified, investigator completes a criminal background check. 
This can help show any propensity toward violence or threatening behavior. B.K.’s 
eriminal reeord revealed nothing indieating a history of communieating threats, 
harassment, or violence. Since B.K. lives in the eommunity, a local background check is 
made and shows no involuntary commitment (IVC) for mental evaluation. Since B.K. 
does not have any eriminal history, he may be blowing off steam as a howler. 

c. Statutory Requirement 

The third eriterion determines whether the post fits the statutory language of a 
threat. B.K. willfully communieated a threat of violence, identified a distinct group of 
people through his threat, and implied a speeific offieer. Investigators eould eriminally 
charge on this post under the third criterion alone. Factoring in the heightened emotions 
after the incident, B.K.’s lack of criminal history, and his threatening language focusing 
on police as a whole, the prosecution of the eharge would be difficult. B.K.’s threats did 
not continue beyond the third post, after whieh he reverted to pre-threat language. 
Beeause his language reverted back to that of pre-incident posts, analysts felt that B.K. 
was a howler. Detectives did not charge, the poster did not commit a violent act. 

2. Facebook Post against the Raleigh Police Department 

The seeond ease study also looks at a post from the February 2016 shooting 
incident and explores a series of posts made by T.W. spanning March 3 to March 6, 2016. 
T.W.’s identity was known. On Facebook, T.W. writes, 

[...] if RPD [Raleigh Police Department] lies one more time. I’m setting 

the whole shit on fire tonight.” Several comments to this post tried to 

dissuade T.W. from using fire. T.W. replied with “... assembling today to 

63 

show force. Meet at 5pm. [...] 

T.W.’s next post is “I ean’t continue to be doeile. ..lam ready to ride or die (bomb, gun, 
bomb [emoji]) I WILL GO ALONE IF NEED BE.”^"^ Three people post eomments telling 

T.W. Facebook page, accessed March 2, 2016, https://facebook.com/mr.nething. 

T.W. Facebook page, https://facebook.com/mr.nething. 
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him not to resort to violence. T.W. writes, “They’re leaving us no choice,” which 
received the comment from another poster “we always have choices.T.W. responds, 
“You have to be willing to die for what you believe in.”^^ 

a. Social Media Language 

T.W.’s language describes a direct action when he writes about “setting the whole 
shit on fire,” but he prefaces that action with certain criteria that must be met before the 
action happens. The rest of T.W.’s language is nonspecific, implied violence. Neither law 
enforcement nor any one individual is named in his threat. It is not clear what he is 
threatening, but T.W. is posting language to be heard. He seeks support, but as seen in the 
comments to his posts, no one latches onto his idea. The conversation lasts for three days, 
longer than any other thread, before T.W. returns to pre-event language. 

b. Criminal Background 

T.W.’s criminal record shows nothing in line with communicating threats, 
harassment, or violence. There has also been no contact with mental health professionals 
recorded by local law enforcement. The language is concerning, but nothing in the 
poster’s background shows threatening behavior or violence. 

c. Statutory Requirement 

There are not enough specifics in his language to meet the elements of 
communicating a threat. The non-specific threat tied to a criterion lowers the fear of the 
violence actually happening. Nonspecific acts also affect the perception that the 
threatener is really able to carry out any action. No further action is taken by police. 

The first two studies contain language consistent with others authored during the 
incident. Detectives discarded re-posts which allowed them to narrow the cases to 22 
rather quickly. All 22 cases contained the type of language that is illustrated in the two 
case studies. By utilizing the three criteria—language, criminal history, and statutory 


T.W. Facebook page, https://facebook.com/mr.nething. 
T.W. Facebook page, https://facebook.com/mr.nething. 
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requirements—Raleigh Intelligenee Center (RIC) deteetives were able to triage posts to 
determine how far to investigate them. Sinee community tensions were high against the 
police, these criteria allow the detectives to conclude that community contact through 
interviewing or taking other inhibiting measures was not needed. None of the 22 online 
threats were acted on by the posters, and each poster returned to pre-incident language. 

3. Facebook Post to the Republican Party 

James T. Hodgkinson shot members of the Republican Party as they practiced 
baseball on June 14, 2017. He came to Washington, DC, from Illinois shortly after the 
presidential election and lived out of his van. The majority of his Facebook posts focused 
on the results of that election, primarily his dislike of the Republican Party. This case 
study examines some of those Facebook posts and starts with a post from March 22, 
2017, that reads, “Trump is a Traitor. Trump Has Destroyed Our Democracy. It’s Time to 
Destroy Trump & Co.” Other posts include one that reads 

I Want to Say Mr. President, for being an a** hole you are Truly the 
Biggest A** Hole We Have Ever Had in the Oval Office, 

posted on June 12, 2017, and another that reads 

Republican B**ch [a reference to Republican Karin Handel on her 
comment that she doesn’t support a living wage] Wants People to Work 
for Slave Wages, when a Livable Wage is the Only Way to Go! Vote 
Blue, It’s Right for You! 

posted on June 8, 2017. Hodgkinson’s identity and posts came from media sources 
reporting on the shooting. 

a. Social Media Language 

The language of these posts does not convey direct threats. The post on March 22, 
2017, uses the word “destroy.” This term can have multiple meanings. It can mean 
something like bringing down the party by voting them out-of-office or something as 

“Saved From https://www.facebook.com/jthodgkinson,” Archive.is Web Capture, accessed 
September 15, 2017, http://archive.is/QF[4A8#selection-2751.0-2751.87. 

“Saved From https://www.facebook.com/james.hodgkinson.568,” Archive.is Web Capture, 
accessed September 15, 2017, http://archive.is/OncTJ#selection-5909.0-5909.128. 
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extreme as killing them one by one. This broad of meaning makes it diffieult to say he is 
threatening physieal harm to Trump and Company. The phrase may provide investigators 
reasonable suspieion to take a deeper look at the poster but without more posts helping to 
elarify the meaning of the “destroy Trump and Company,” the post is not a threat of 
violenee. In this ease, Hodgkinson eontinues to post about the Republiean Party. He uses 
offensive words sueh as asshole and biteh to deseribe the president and his displeasure in 
the platform. None of his posts eomment further on any aetion he is planning to take that 
helps define his meaning of the word “Destroy.” None of his posts meet the definition of 
a threat. 

b. Criminal History 

The Faeebook poster is readily identified as James T Hodgkinson. The word 
“Destroy” in the post provides reasonable suspieion to look at Hodgkinson’s eriminal 
history. His eriminal history shows one ineident resulting in two assault eharges and one 
aggravated diseharge of a firearms eharge. This information is useful, but sinee the 
wording of the posts did not rise to a direet threat, this one ineident would probably not 
raise mueh eoneem. 

c. Statutory Requirement 

The language of the posts do not meet statutory requirements of threats. None of 
the posts say that Hodgkinson is going to hurt anyone. The post saying it is time to 
destroy Trump and Company is not detailed enough and does not meet the other statutory 
requirement of fear that the aet ean really happen. Even with a eriminal history of 
assaults, without the poster meeting the language requirements, a distriet attorney would 
not have pressed eharges. This is the primary reason why eriminal history alone does not 
eause mueh eoneern for investigators. 

4. Faeebook Post to New York Police Officers 

On July 5, 2017, John Bonds shot and killed a New York City poliee offieer while 
she sat in a eommand vehiele. The shooting appears unprovoked as video of the erime 
shows Bond walking from a store and along the wall toward the eommand vehiele. 
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Shortly after the shooting, a Facebook Live video from September 2016 shows Bond 
talking harshly about the police. The media posted this video during the reporting on the 
incident. As with the other three case studies, this study looks at Bonds’ video through its 
language, the poster’s criminal history and the statutory requirements to call it a threat. 

The Wall Street Journal reports that Bonds made the video in September 2016, 
and it contained the following language: 

I’m not playing. Mister Officer. 1 don’t care about a hundred police 
watching this s—shit. You see this face. You see this face or anything, 
leave it alone. Trust and believe, [...] 

I’m not hesitating. It ain’t happening, [.] I wasn’t a b— bitch in jail, 

and I’m not going to be a b— bitch in the streets. 

Other comments from this video are documented by the Daily News as 

Y’all n-s so reluctant to want to say something to the police, man, 

Man, police is f-—ts, and this ain’t no gimmick. F—ts. [...] N-s ain’t 

taking it no more, Mr. Officer. I’m here to tell you, man. ... just keep your 
a— away from mine.’° 

a. Social Media Language 

The language in this video does not threaten violence. Bond’s emotionally 
narrates as if talking directly to a police officer. He angrily tells them that they should not 
mess with him; that he wants to be left alone. Bond’s word “I’m not hesitating” seems to 
imply he will act if the police mess with him but he does not qualify that comment with a 
type of action. His rant ends by repeating his plea to the police to stay away from him. 
This still does not rise to a direct threat against anyone. This video appeared among 


Kristen Phillips, Mark Berman, and Wesley Lowery, “I’m Not Playing, Mr. Offieer’: Gunman 
Appears to Complain About Poliee Mistreatment in Video Months Before Shooting NYPD Offieer,” 
Washington Post, July 5, 2017, https://www.washingtonpost.eom/news/post- 

nation/wp/2017/07/05/assassinated-nypd-offieer-shot-and-killed-while-sitting-in-a-poliee-vehiele-offieials- 
say/?utm_term=.al 962edefe 15. 

; and Graham Rayman, and Larry Meshane, “NYPD Cop Killer Alexander Bonds Posted Anti-Poliee 
Faeebook Rant,” Daily News, July 5, 2017, http://www.nydailynews.eom/new-york/nye-erime/suspeeted- 
nypd-shooter-assaulted-offieer-brass-knuekles-artiele-1.3302356. 
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Bonds’ other posts, which are mostly inspirational quotes.^' Officer routinely get told that 
people want to be left alone so these statement are not uncommon. 

b. Criminal History 

Bonds has a lengthy criminal history. He was paroled in 2013 after a prison 

79 

sentence for robbery. His record also includes charges of assaulting an officer with 
brass knuckles. News reports do not indicate whether Bonds has any IVC, but ABC 
News reports his girlfriend as saying he was not taking his psychiatric medicine, 
implying that he had mental illness.’"^ The criminal record and mental illness is 
concerning, but the type of ramblings are not uncommon among people that have had 
multiple arrests by the police, particularly when they have mental illness. A person 
making these comments would not cause concern past putting out an officer safety 
bulletin for officers to approach him with caution. 

c. Statutory Requirements 

The language of Bond’s posts do not indicate violence toward any specific officer 
or officers. He does not talk about any specific violence at all. He does say that if he is 
not left alone, that he will do something but that something is not identified. Without 
more specific details, the language does not meet statutory requirements to charge Bonds 
with a crime. 

C. CONCLUSIONS 

The cases in this chapter came from three incidents involving four unacquainted 
individuals. Two of the individuals attacked people after their concerning posts. 
Hodgkinson wrote letters to political representatives and posted constantly the days 
leading up to him shooting a senator. These posts are very anti republican but do not 

Colleen Long and Jennifer Peltz, “Officer’s Killer had Ranted About Police Killing and Abusing,” 
ABC News, July 5, 2017, http://abcnews.go.com/US/wireStory/female-pobce-officer-critical-shooting- 
bronx-48444782. 

Long and Peltz. 

Long and Peltz. 

Long and Peltz. 
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threaten violence. Bond posts an emotional video but no violence follows immediately. 
His Facebook page contains inspirational quotes until he shoots a police officer ten 
months after the video for police to leave him alone. With both Hodgkinson and Bond, it 
is unclear whether law enforcement knew about their posts before the attacks. Raleigh 
police learned of the posts for the first two case studies shortly after they appeared on 
Facebook. None of the four case studies contains language that meets statutory 
requirements of a threat. Interestingly, the examples do show that violence can follow 
posts that do not meet the requirement of a threat. 

Police intervention in Facebook and Twitter post cases is difficult. Investigators 
are first hindered by statutory requirements needed for them to use the legal system to 
make criminal charges. The language of the post must directly identify who is targeted 
and make those people feel like the threat is really going to happen. As the case studies 
illustrate, the language is usually not that specific. The second option the police have is to 
go talk to the person authoring the post. Sometime just talking to the person can be 
successful in deterring violence, or it can further infuriate the person. Knowing this 
places investigators in a position where they must make a subjective decision. This 
causes situations where investigators may decide not to do anything. They cannot charge 
because the language of the threat does not meet the statutory requirements and they feel 
that talking to the subject may make him angrier. This causes a situation where cases that 
need intervention may not receive it. 
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III. AUTOMATING TWITTER AND FACEBOOK 
THREAT INVESTIGATIONS 


The previous ehapter showed how current social media threat investigations work. 
This process is slow, resource intensive, and subjective. Using technology could speed up 
investigations, lower resource needs, and improve objectivity. In an attempt to move 
investigative practices toward using technology, this chapter takes on a different format. 
Proposing new software requires utilizing a technical format to communicate the needed 
software functions to a developer. These technical instructions used to be long detailed 
documents, but in agile business communities, they are very concise.In this chapter, a 
software requirement specification (SRS) document details a tool to assist investigators in 
locating a threat, analyzing the threat language, running a poster’s criminal background, 
and ultimately deciding which cases investigators should investigate. The sections 
consisting of an introduction to the software, a description of the software, and case 
stories on the use of the software show the functional requirements. Each of these 
sections complies with a suggested standard designed by the Institute of Electrical and 
Electronics Engineers (IEEE). The opening letter of IEEE 830-1998 provides a good 
explanation of the recommended standards and their use: 

IEEE Standards documents are developed within the IEEE Societies and 
the Standards Coordinating Committees of the IEEE Standards 
Association (lEEE-SA) Standards Board. The IEEE develops its standards 
through a consensus development process, approved by the American 
National Standards Institute, which brings together volunteers representing 
varied viewpoints and interests to achieve the final product....Use of an 
IEEE Standard is wholly voluntary... Every IEEE Standard is subjected to 
review at least every five years for revision or reaffirmation. When a 
document is more than five years old and has not been reaffirmed, it is 


Jerry Cao, “A Practical Approach to Functional Specifications Documents,” Studio, accessed 
September 15, 2017, https://www.uxpin.com/studio/blog/practical-approach-functional-specifications- 
documents/. 
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reasonable to eonelude that its contents, although still of some value, do 

not wholly reflect the present state of the art... 

The SRS in this document stays consistent with the intentions of the IEEE but does 
include some variation. Case stories, not specifically mentioned in the IEEE standard, 
conclude the SRS as a way of providing developers a way to visualize the complexity of 
the programing needed to develop this tool. 

Including the case stories in the SRS gives developers and future users four 
scenarios that illustrate how each part of the system must work together in producing a 
threshold confidence score. Each of these case stories provide different characteristics 
that need considered to calibrate the software correctly. Case stories one and two exhibit 
language closer to direct threats than cases three and four. Case stories three and four, 
however, are the ones that end in violence. Both of the individuals did have crimes 
involving violence in their past while case studies one and two did not. The correlation 
between threat language and criminal history will need further study but could affect how 
the coding provides scores for these areas. The criminal history may need heavier 
weighting than the sentiment and wording of the language. The case studies demonstrate 
how a heavily weighted criminal history affects the confidence score and suggests that 
investigators look into the individual’s posting further. If this software were to have 
helped locate and alert investigators to the posts that met threshold limits, intervention 
strategies may have changed the outcomes of the two cases that ended in violence. 

Another area not illustrated in the case stories is the occurrence of false positives 
and false negatives. Ealse positives related to threat investigation happen when the 
software identifies threats that meet the confidence threshold, but when assigned to a 
detective, the detective decides there is no threat. This is a checks and balance system for 
the software. Detectives take the information given by the software and apply their 
intuition and knowledge of their individual communities to make a final decision. The 
outcomes still feed back into the software and influence machine learning, which helps 


IEEE. IEEE Std 830-1998 IEEE Recommended Practice for Software Requirements Specifications. 
IEEE Computer Society, 1998. 
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continually calibrate the software outputs. The other oecurrenee is a false negative. A 
false negative happens when a post’s eonfidenee seore does not trigger an alert and 
violenee still happens. These seenarios provide information for maehine learning, 
hopefully allowing better ealibration for future events. These types of events also 
illustrate Calhoun and Watson’s hunter eategory for people that earry out violenee. A 
hunter does not provide elues of an impending attaek. The software not alerting on their 
posts provides further evidenee of hunters’ ability to stay below the radar of authorities. 

While the outeomes of false positives and negatives ean help the software learn 
and ealibrate itself, a eoneem of the software over-ealibrating to the point of infringing 
on free speeeh develops. Case story three shows some of these eoneerns. The language in 
Hodgkinson’s posts is eornmon for people posting their politieal disagreement. The 
software in this ease takes into aeeount the esealation, the negativity, the amount of posts, 
and the poster’s arrest reeord before caleulating a eonfidenee seore that triggers an alert. 
Software performing this step proteets citizens from violations of their free speeeh. Law 
enforeement does not get to see any of these posts until the total seore triggers the 
threshold alert. Setting the threshold level requires aeeuraey in determining the likelihood 
of violenee. Reaehing the threshold signifies that there is reasonable suspieion violenee 
may happen. This is the same threshold law enforeement must have to investigate posts. 

In these ease stories, subjeetivity still influeneed the seoring. The scorer knew the 
outcomes of eaeh story prior to the seoring. It is possible an investigator looking at these 
eases as they are playing out would seore them differently. A larger data set of threats 
needs to be analyzed to align how each category scores. Maehine learning takes the 
subjeetivity away from people. The software learns from the outeomes of eaeh threat it 
identifies. Adjustments to the algorithm improve the aeeuraey in identifying threats that 
end in violenee. This ability helps take the subjeetivity out of investigators’ deeisions. As 
shown through ease story eomparisons in Chapter II and the SRS in Chapter III, the 
automated method may allow law enforcement intervention before violence happens. 
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Calhoun and Weston, Concepts and Case Studies, 11. 
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Software Requirement Specification 
for a Social Media Threat Assessment Tool 


1. INTRODUCTION 

1.1 Purpose 

The purpose of this document is to provide the details for creating software to 
assess social media threats. It explains how social language sentiment software, a public 
records search engine, and a confidence scoring tool interface to decide which social 
media posts warrant investigator intervention to prevent violence. This document details 
the software interfaces as well as the system’s functions, and constraints to its operations. 
Case stories contained in this document help clarify the functional requirements of the 
software for both developers and end users. Part of this clarification contains limitations 
and obstacles that programmers must overcome. 

1.2 Product Scope 

The goal of the software is to help law enforcement investigators discover threats 
made over social media to start assessments and interventions prior to acts of violence. 
As a step to reach this goal, subjectivity needs to be removed from investigations. 
Machine learning and historical events function to objectively identify social media 
language that ends in violence. The software also protects citizens by identifying only the 
posts that meet a threshold for the possibility of violence. No other posts are reported to 
law enforcement. 

This software will use confidence scoring to identify social media threats for law 
enforcement investigators. The software locates threats posted on social media 
applications through keyword searches and sentiment analysis tools. It then locates any 
poster identification information, compares it to criminal history records, and sends both 
the sentiment analysis and the criminal history information to a confidence-scoring tool. 
If the confidence-scoring tool results in a score that meets or exceeds a predetermined 
threshold, the software alerts the user to the threat. After the alert, the software generates 

a report that provides investigators information to further assess the risk for violence. 
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Each component in this software paekage already exists. The uniqueness of this 
new system is in the ability of the different eomponents to work together. The other 
unique ability is after initial input from developers, the software operates independently 
of investigators, alerting only to threats that reaeh the predetermined threshold. 

1.3 Definitions, Acronyms and Abbreviations 


User 

Someone who interacts with the software 

SQE 

Structured query language 

API 

Application program interface 

RMS 

Report writing management system 

CAD 

Computer aided dispatch 

SRS 

Software requirement specification 


1.4 References 

IEEE. IEEE Std 830-1998 IEEE Recommended Practice for Software Requirements 
Specifications. IEEE Computer Society, 1998. 

1.5 Overview 

The rest of this document includes three sections. Section 2 contains an overview 
of system functionality and interactions between other softwares contained in the system. 
This section also talks about the users and their interactions with the system. Einally, it 
explains the constraints and assumptions of the software. Section 3 provides the 
specification requirements in more detail and in terms that both a developer and an end 
user will understand. Section 4 presents a requirement analysis through the use of user 
stories. These stories help the developer visualize the system’s functionality. These 
stories also explain to the law enforcement end user how the software determines which 
threats trigger the threshold alert. 
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2 . 


GENERAL DESCRIPTION 


In this section, hypothetical software is examined that assists investigators with 
locating a threat, analyzing the threat language, running a poster’s criminal background, 
and ultimately deciding which cases investigators should investigate. To complete these 
tasks, this section explains how a social language sentiment software, a public records 
search engine, and a confidence scoring tool interface to decide which social media posts 
warrant intervention by investigators to prevent violence. 

2.1 Product Perspective 

The threat software is primarily self-contained software, operating with cloud 
technology. Once coded and calibrated by software and law enforcement teams, the end 
user requires limited ability to make adjustments to the algorithms. Users do interact 
through a web-based application. This means that clients do not need to invest in 
additional hardware. The software should be developed with the potential for end users to 
access software alerts over mobile devices such as smartphones. The software must either 
interface with or encode three existing software capabilities: social media analytics, 
language sentiment analysis, and confidence scoring. Connection with criminal history 
information requires an external interface to data held by law enforcement agencies or 
public record database companies. Figure 1 below illustrates the work-flow of the 
software 
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Figure 1. Block Diagram of Social Media Assessment Tool. 


2.1.1 System Interfaces 

The system is self-contained and accessible over a web browser. The system 
interfaces with an end user as well as other software and databases. These interfaces 


29 














happen via a network-to-network connection through the internet as well as by 
connecting to databases through the use of SQL. 


2.1.2. User Interfaces 

There are two users who interact with the software. The development team 
designs and calibrates the system. They interact through the coding of the software and 
have the ability to input data through code to continually calibrate the system. Including 
the ability of machine-learning decreases the need for manual entry of calibrating data. 

The second user is the law enforcement investigator. This category of users 
accesses the software through a web portal. They have the ability to access alerts and 
reports generated by the software. The users do not have access to other functions of the 
software to protect the objectivity. 

2.1.3 Hardware Interfaces 

The software is cloud-based, housed within a company’s controlled servers. 
Connections to investigators’ computers happen over internet connections from these 
servers to individual computers, each computer logging into the software remotely. 
Smartphone access allows alerts to reach investigators when away from their desks. This 
connectivity is also over a log-in through an app on the smartphone that remotely logs 
into the company-controlled software servers which has the software on it. 

2.1.4. Software Interfaces 

The system contains multiple applications already commercially available. 
Interfaces need developing that allows an existing social media analyzer to include a 
language sentiment algorithm. Another interface allows the data from the social media 
analyzer to pass to the confidence-scoring applications. Separately, an interface needs 
establishing between the social media analyzer and a database containing criminal history 
information. Finally, an interface between the confidence-scoring tool and the criminal 
history database provides the data needed to compute a confidence score. The product 

function section explains these interfaces in more depth. 
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2.2 Product Functions 


This software incorporates a number of different applications to perform its 
function. These applications may be commercially available but may require additional 
programming to make each work with the confidence scoring application. Each of the 
following subsections explains the separate software in more detail and describes how 
each part functions within the final system. 

2.2.1 Social Media Analysis Software 

Social media analysis software must utilize an API to Twitter and Facebook. 

Social media analysis software interfaces with Facebook and Twitter. An API 
allows the social media analyzer to access content from these sites. The established 
connections let the analyzer scan Twitter and Facebook posts quickly. Keywords help 
identify concerning posts. Common keyword searches by investigators include gun, 
shoot, kill, hit, run over, police, gangs, or other words derived from specific 
investigations. Past language of posts that ended in violence and recommendations from 
law enforcement experts’ help determine what words accurately identify threats. Fexis 
Nexis is one company that already uses software to scan Twitter and Facebook for 

•70 

keywords and phrases. Exploring commercially available software like Fexis Nexis can 
guide developers on this software function or provide a platform of established code. 

2.2.2 Language Sentiment 

A natural language analyzer must scan each line of text input from the social media 
analysis software. The natural language analyzer must function within the social media 
analyzer software. 

Natural language analyzer software scans each line of text and provides a negative 

70 

or positive sentiment. The analyzer does this by identifying proper and common nouns 

“Defense Community and Homeland Security,” Lexis Nexis Special Services, Inc., July 8, 2017. 
http://lexisnexisspecialservices.com/who-we-serve/defense-department/. 

“Natural Language API Basics,” Google Cloud Platform, accessed July 8, 2017, 
https://cloud.google.com/natural-language/docs/basics. 
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within text and providing a negative, positive, or neutral emotion toward the noun by the 
poster. This means the software ean read “ I hate the Cowboys” and return an opinion 
that the writer has a negative opinion toward the Cowboys. Taking it even further, 

language sentiment software ean capture the context of messages. A message that reads 

82 

“My flight was cancelled. Great!” could be read as positive. The software can recognize 
that “Great!” in this instance is negative. The social media analyzer and the sentiment 
tool must be designed to work together and compute a confidence value that passes to the 
confidence-scoring tool. 

2.2.3 Public and Criminal Record Search 

Criminal record information from public records or a RMS must be accessible through 
an SQL server or another appropriate interface. 

Public record databases house identifying information pulled from motor vehicle 
records, criminal convictions, or judgements and liens. Running the owner of the social 
media account through this database returns information on his place of residence, his 
associates, and his criminal convictions. Lexis Nexis also provides a way to pull local law 
enforcement RMS and CAD information, allowing a comprehensive score for a poster’s 
criminal background. If a person has a criminal background, this part of the software 
assigns a score based on the conviction crime type. For example, if the poster is John 
Smith, the software looks for other identifying information, such as hometown or date of 
birth, on the social media account. For instance, this information may show that John 
Smith has a birthdate of January 2, 1973, lives in Experiment, Georgia, and has a 
criminal conviction for communication of threats and assault. Since this identity is tied 
with a post that has a negative sentiment, this person’s criminal conviction is compared to 

“Natural Language API Basics.” 

Kristian Bannister, “Understanding Sentiment Analysis: What it is & Why it is Used,” Brandwatch, 
January 26, 2015, https://www.brandwatch.com/blog/understanding-sentiment-analysis/. 

Bannister. 

Bannister. 

“Accurint Crime Analysis Workstation,” Lexis Nexis Risk Solutions, accessed July 8, 2017, 
http://www.lexisnexis.com/risk/products/govemment/accurint-crime-analysis-workstation.aspx. 
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a predetermined list. Certain crimes score higher than others on this list. Hypothetically, 
the communication of threats charge may receive a score of three while the assault may 
score four points. Crimes that involve personal injury score higher than crimes involving 
property damage. The score passes to the next stage in the software, confidence scoring. 

2.2.4 Confidence Scoring 

The language sentiment value and the criminal history data value interface with the 
confidence-scoring algorithm. The confidence score must be calculated for a confidence 
threshold. When the confidence threshold is met, an alert signals the user. 

Confidence scores are numbers assigned to the certainty for findings. As the 
name implies, the scores can show a level of probability an event might happen. In the 
case of threat investigations, alerting investigators when a threshold is reached is more 
important than finding the probability. This threshold is a predetermined score that if 
reached, requires assignment of the case to an investigator. A critical step in this process 
is determining the correct threshold to cause that alert. This SRS follows the below steps 
proposed by Bill Murdock for determining these thresholds: 

1. Assign numerical rewards to each possible outcome 

2. Run a large number of queries for which you know the outcomes. 

3. For each possible threshold, compute the net reward for the system at each 
possible threshold. 

07 

4. Select the threshold that has the greatest reward. 

This process involves using threat cases from the past, assigning values for the language 
sentiment and criminal history components as well as running the queries through the 
system. 

One way to obtain these values and calculate confidence scoring is to calculate 

00 

trust scores. If an investigator performs confidence scoring manually, he has to get the 

Bill Murdock, “How to select a threshold for Acting Using Confidence Scores.” 

Murdock. 

Murdock. 

^^“How to Calculate a Confidence Score,” CrowdFlower, accessed July 7, 2017, 
https://success.crowdflower.eom/hc/en-us/articles/201855939-How-to-Calculate-a-Confidence-Score. 
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help of a number of experieneed investigators. Eaeh investigator rates each post’s 
language sentiment and criminal history as well as assigns a trust value to each. These 
data are then sent through the following series of calculations; 

1. Sum the trust scores of the contributors for each response. 

2. Sum the trust scores of all the contributors 

OQ 

3. Divide each in (1) by (2) to find the confidence score for each response. 

The results from calculating trust scores for a series of threatening posts are compared 
against threat follow-through to violence. A trust score that corresponds with an outcome 
of violence is picked for an alert to investigators for follow-up. Manually computed threat 
scores provide the baseline for the software to calculate the thresholds. The performance 
of these thresholds may change over time as machine-learning identifies changes in the 
threat scenarios, so threshold calibration is evaluated routinely. 

2.3 User Characteristics 

Law Enforcement makes up the user of this software. The investigators’ function 
includes threat investigations but also includes handling multiple cases of different crime 
type. Multiple investigators may work threat cases. They cannot devote all their time 
monitoring software for an alert. Time at a desk varies from case to case. This group of 
user usually has a smartphone and is familiar with using applications on it. Important 
software characteristics for this user are the ability to receive alerts on multiple 
computers and/or smartphones in one agency. Online access to the software report also 
benefits the user. They can access the report anywhere and start interventions as needed. 
Printable reports help preserve evidence and complete case files. 

2.4 Constraints 

Since this is law enforcement software, certain boundaries must be maintained in 
accessing citizen’s information. Most of these constraints center on maintaining the 
privacy of people who do not post threatening language. The first constraint is that he law 

^^“How to Calculate a Confidence Score.” 
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enforcement user cannot see the social media language until after an alert. The second is 
that law enforcement cannot access the algorithms used in the software. The third is that 
the software cannot store social media posts that do not alert investigators for more than 
90 days. Finally, the software must be able to store data related to alerts indefinitely. 
Cases that result in charges can last for years and evidence must be kept. In the case of 
homicides, even after trial, the evidence must be kept in case of appeal for many years. 
Each jurisdiction’s rules are different so the ability to retain certain data for different 
lengths of time is important. Rules about evidence storage apply to this constraint as they 
apply to each individual case. 

3. CASE STORIES 

In the previous chapter on manual investigations, four case stories explored the 
way investigator subjectivity influences cases. In this user case section, the same 
incidents help illustrate how the proposed software guides investigators in determining 
which cases to give priority. This section looks at the same cases and applies language 
sentiment, criminal history, and confidence scoring in order to evaluate threat risk. 
Normally user cases illustrate how the user interfaces with the software. Since after initial 
setup this program runs independent of the user, the cases here demonstrate the pathway 
the software uses in determining whether a threat reaches the confidence threshold. In 
order to accomplish this task, some assumptions need defined. The language sentiment 
tool uses a hypothetical value range of 0-10. The criminal history section assigns values 
within the range of 0-5. The confidence scoring range assigns values of 0-10. The 
hypothetical threshold value for these studies is 5. The values representing calculations 
from sentiment analysis and criminal histories were determined by the author’s 23 years 
of experience investigating threats, not by a group of experts as normally is necessary to 
achieve more accurate ratings. 

3.1 Facebook Post against Officer Twiddy 

In February 2016, a Raleigh Police officer shot a suspect during a struggle. 
Shortly after the incident, people from the community started posting on Facebook and 
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Twitter. A lot of these posts talked negatively about the police. Other posts 
communicated threats toward law enforcement. This case study is taken from a Facebook 
post made after the shooting. The person posting was identified and referred to here as B. 
K. He posts the following comment: 

Im sorry I don’t normally think about this but peaceful protesting? For 
what? For them to continue to take us African Americans as a joke. I may 
be wrong but the way I’m feeling it’s time to shoot some of they kind 
down too. We always talk about other cities going through what we going 
through && what we would do. I’m going to support my city 100% RIP 
Lockman^'* 

This post is followed by a comment from another subject wanting peaceful protests in his 
neighborhood, fearing houses my get shot up where they live. B. K. replies to this 
individual with 

Ain’t nobody thinking about shooting up nobodies house or kids.I 

said shoot some of their kind down not go shoot up houses and kill kids.^' 

B. K. then posts on his Facebook page a picture of two t-shirts, one reading “F*** a cop 
named Twiddy” and the other “100 to 500 RIP Lock AKA.”^^ 

3.1.1 Language Sentiment 

Preprogrammed keywords locate the post’s language of “shoot some of they 
down,” and “F*** a cop.”^^ Each line of the poster’s account is scanned by the language 
sentiment tool. B. K.’s post is very negative. He questions the usefulness of peaceful 
protests and suggests the police do not respect African Americans. He also says he feels it 
is time to shoot a cop. The addition of the woxA feeling is the only thing keeping this post 
from being a direct threat. Each sentence receives a positive, negative or neutral score, 
which is then assigned a number that correlates with a degree. Table 1 shows the sentence 
and the assigned value for negative sentiment toward police. 


B.K. Facebook page, https://facebook.com/prfile.php?id=100010733497326&fref=ts. 
B.K. Facebook page, https://facebook.com/prfile.php?id=100010733497326&fref=ts. 
B.K. Facebook page, https://facebook.com/prfde.php?id=100010733497326&fref=ts. 
92 B.K. Facebook page, https://facebook.com/prfile.php?id=100010733497326&fref=ts. 


36 




Table 1. B. K.’s Post Sentiment^"^ 


Social Media Text 

Sentiment Value 

Im sorry I don’t normally think about this but 
peaceful protesting 

3 

For what 

0 

For them to continue to take us African 
Americans as a joke. 

3 

I may be wrong but the way I’m feeling it’s 
time to shoot some of they kind down too. 

7 

We always talk about other cities going 
through what we going through && what we 
would do. 

2 

I’m going to support my city 100% RIP 
Lockman 

2 

Ain’t nobody thinking about shooting up 
nobodies house or kids 

0 

I said shoot some of their kind down not go 
shoot up houses and kill kids. 

7 

F*** a cop named Twiddy 

7 

100 to 500 RIP Lock AKA 

2 


The average of these values is 3.3 and passes to the eonfidenee seoring tool. 


3.1.2 Criminal Background 

Once the language sentiment analysis is complete, the poster’s identity moves into 
a search engine that researches criminal backgrounds through a public records database 
or tied into an agency database. B. K. has no violent crime, harassment or offenses of 
communicating threats in his criminal history. A specific criminal history for B. K. is 
unavailable since the investigation into his posts does not result in criminal charges. For 

B.K. Facebook page, https://facebook.com/prfde.php?id=100010733497326&fref=ts. 
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this study, a value of 0 is used sinee nothing violent or threat-related has been 
doeumented. 


3.1.3 Confidence Scoring 

The language sentiment score and the criminal history score move to the 
confidence scoring process. In B. K.’s example, the 3.3 from the sentiment score and the 
0 from the criminal history score automatically proceed to the confidence scoring 
algorithm. For these case studies, the confidence score is the sentiment score added to the 
criminal history score. The calculated value of 3.3 does not meet the predetermined 
threshold of 5 so the software does not alert investigators. 

3.2 Facebook Post against the Raleigh Police Department 

This second case study looks at a post following the same incident as the first case 
study and explores a series of posts made by T. W. spanning March 3 to March 6, 2016. 
T. W.’s identity was known. On Facebook, T. W. writes, 

[...] if RPD [Raleigh Police Department] lies one more time, I’m setting 
the whole shit on fire tonight.” Several comments to this post tried to 
dissuade T.W. from using fire. T. W. replied with “... assembling today to 
show force. Meet at 5pm. [.. .]^^ 

T. W.’s next post is 

I can’t continue to be docile. ..lam ready to ride or die (bomb, gun, bomb 
[emoji]) I WILL GO ALONE IF NEED 

Three people post comments telling him not to resort to violence. T. W. writes, “They’re 
leaving us no choice,” which received the comment from another poster “we always have 
choices.T. W. responds, “You have to be willing to die for what you believe in.”^^ 


T.W. Facebook page, https://facebook.com/mr.nething. 
T.W. Facebook page, https://facebook.com/mr.nething. 
T.W. Facebook page, https://facebook.com/mr.nething. 
T.W. Facebook page, https://facebook.com/mr.nething. 
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3.2.1 Social Media Monitoring and Language Sentiment 


Programmed keywords loeate the RPD referenee in this post along with “I’m 
setting the whole shit on fire tonight. Seanning his posts sentenee by sentenee 
produees Table 2 of sentiment values. 


Table 2. T.W. Post Sentiment^®*’ 


Social Media Text 

Sentiment Value 

if RPD [Raleigh Police Department] lies one 
more time, I’m setting the whole shit on fire 
tonight 

7 

assembling today to show force. Meet at 5pm 

5 

I can’t continue to be docile 

5 

I am ready to ride or die (bomb, gun, bomb 
[emoji]) I WILL GO ALONE IF NEED BE. 

4 

They’re leaving us no choice 

4 

You have to be willing to die for what you 
believe in 

4 


This post has eoneerning language in it with the poster saying he is “setting the whole 
shit on fire tonight.”**’' The poster adds a criterion that RPD has to lie before he acts. This 
additional statement lessens the likelihood of violence. T. W.’s entire text is very 
negative, but the other sentences do not contain further threats. The sentiment score for T. 
W. is a 4.8. 


T.W. Facebook page, https://facebook.com/inr.nething. 

100 y \y Facebook page, https://facebook.com/mr.nething. 

101 7 \y Facebook page, https://facebook.com/mr.nething. 
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3.2.2 Criminal Background 


The program then looks at T. W.’s eriminal history. Running his name through 
the publie seareh engine portion of the software reveals no violent eriminal history, no 
harassment, and no eommunieation of threat. This information reeeives a seore of 0, and 
the seore moves into the eonfidenee scoring section. 

3.2.3 Confidence Scoring 

The language sentiment score and the criminal history score move to the 
confidence scoring section. In T. W.’s example, the 4.8 from the sentiment score and the 
0 from the criminal history score input into the confidence scoring algorithm. The 
confidence score is the sentiment score added to the criminal history score. In this 
example, the algorithm returns a confidence score of 4.8. The threshold is predetermined 
as 5, so although this case is borderline, it does not alert investigators. 

3.3 Facebook Post to the Republican Party 

James T. Hodgkinson shot members of the Republican Party as they practiced 
baseball on June 14, 2017. Law enforcement shot and killed Hodgkinson during the 
attack. This case study examines his Facebook posts. This study starts with a post on 
March 22, 2017, that reads 

Trump is a Traitor. Trump Has Destroyed Our Democracy. It’s Time to 

Destroy Trump & Co.''*^ 

The posts on Facebook surrounding this one center around the poster’s hate for the 
Republican Party. Other posts include language such as 

I Want to Say Mr. President, for being an a** hole you are Truly the 

Biggest A** Hole We Have Ever Had in the Oval Office, 

posted on June 12, 2017, and 

Republican B**ch [a reference to Republican Karin Handel on her 

comment that she doesn’t support a living wage] Wants People to Work 

“Saved From https://www.facebook.com/jthodgkinson.” 
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for Slave Wages, when a Livable Wage is the Only Way to Go! Vote 

Blue, It’s Right for You! 

posted on June 8, 2017.'°^ 

3.3.1 Social Media Monitoring and Language Sentiment 

This ease does not contain clear-cut threatening language. The language in the 
March 22, 2017, post says that “It’s Time to Destroy Trump & Co.,” but destroyed is not 
a common keyword for violent acts.'°'^ It is possible that the Secret Service, in its duty to 
protect the president, would monitor for this broader term. Running the program for 
negative sentiment against Trump should flag these posts. The sentiment of the language 
is negative but does not indicate direct violence. 

The first clearly negative post toward Trump came in March 2017. Around 26 
other accessible posts with multiple sentences are available for the time span from March 
2017 through the shooting on June 14, 2017. Table 3 shows the assessable comments and 
the hypothetical scoring. 


“Saved From https://www.facebook.com/james.hodgkinson.568.” 
“Saved From https://www.facebook.com/jthodgkinson.” 
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Table 3. Hodgkinson Post Sentiment' 


Social Media Text 

Date 

Sentiment 

Trump is a Traitor. Trump Has Destroyed Our Demoeracy. It’s Time to Destroy Trump 
&Co. 

3/22/2017 

5 

Sign the petition for independent investigation 

5/21/2017 

0 

Sign the petition to stop the NEXUS pipeline 

5/24/2017 

0 

Emperor Maximus Imbeeilus repost picture of trump 

6/3/2017 

3 

Gov. Jerry Brown Tells Trump He’s Wrong .... What Else Is New? 

6/3/2017 

3 

Willie is a Good Dude. ( willie picture saying we need to treat others fairly) 

6/4/2017 

0 

Share if you agree on limiting congress to 2 terms like the president 

6/4/2017 

0 

A lot of guessing (picture of science students) 

6/5/2017 

0 

Everyone Must Register to Vote & When the Day Comes You Must Vote 

6/5/2017 

0 

Eame! (how well do you know your hippie slang quiz) 

6/5/2017 

0 

Trump flunks most tests ( reference headline of Trump flunking leadership test after 
London attack) 

6/5/2017 

3 

Coincidence? I Think Not! (reference to Trump speech during Comey hearing) 

6/8/2017 

4 

Eounding Fathers Would Hate What Our Democracy Has Morphed Into. We Now Have 
an Aristocracy, a Corporatocracy, & an Oligarchy, & a Plutocracy. This Turns Our 
Country Into a Fascist State! Vote Blue, It’s Right for You! 

6/8/2017 

5 

Republican Bitch Wants People to Work for Slave Wages, when a Livable Wage is the 
Only Way to Go! Vote Blue, It’s Right for You! (about a headline of Georgia republican 
not supporting livable wage. 

6/8/2017 

6 


‘Saved From https://www.facebook.com/jthodgkinson,”; and “Saved From https://www.facebook.com/james.hodgkinson.568.’ 
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Social Media Text 

Date 

Sentiment 

That should do it (reference picture with caption How to solve global warming. Convince 
republicans that rising temperatures are turning people gay.) 

6/8/2017 

6 

Shared memory of Sanders campaign 

6/10/2017 

2 

Please. (Image with text: stop fighting over who created the world and fight against the 
people who are destroying it.) 

6/11/2017 

1 

Bemie Sanders Day post 

6/11/2017 

1 

Trump is a Mean, Disgusting Person. 

6/12/2017 

6 

Repeat of Bernie Sanders day 

6/12/2017 

1 

Trump is Guilty & Should Go to Prison for Treason. 

6/12/2017 

7 

Are You One of the Twenty-Three Million? That’s a Lot of People 

6/12/2017 

0 

Make America Great Again, Resign! (pic: Trump with all n all just another prick in the 
wall) 

6/12/2017 

6 

I Want to Say Mr. President, for being an ass hole you are Truly the Biggest Ass Hole 
We Have Ever Had in the Oval Office. 

6/12/2017 

7 

Closed Primaries are What Third World Countries Have. Open them for all Candidates. 

6/12/2017 

4 

That’s Exactly How It Works.(pic with How does a bill work? Corporation writes bill 

and then bribe congress until it becomes law) 

6/13/2017 

6 
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Assigning each piece of text a sentiment value and calculating an overall score 
produces a score of 2.9. This may seem like a low score for the amount of anti-Trump, 
anti-Republican, and anti-government language. It is not uncommon for people to voice 
their negative opinions on topics they feel strongly about, so these post, while negative, 
are not threatening. 

3.3.2 Criminal Background 

The account owner is clearly identified as James T. Hodgkinson. The software 
searches criminal history information on his identity. Substituting for the software in this 
instance, news reports provide information based on public record searches; James 
Hodgkinson has prior arrests for two assaults and an aggravated discharge of a firearm. * 
The charges did not end in convictions. The assaults and firearms charges are violent 
crimes and produce a score that averages all three charges to a 4. 

3.3.3 Confidence Scoring 

The language sentiment score and the criminal history score move to the 
confidence scoring section. In Hodgkinson’s example, the 2.9 from the sentiment score 
and the 4 from the criminal history score input into the confidence scoring algorithm. The 
addition of the two numbers returns a confidence value of 6.9. The threshold is 
predetermined as 5, so this case causes an alert to investigators that they need to 
investigate Hodgkinson further. 


1 Jose Pagliery, “Suspect in Congressional Shooting was a Bemie Sanders Supporter, Strongly Anti- 
Trump,” CNN, June 15, 2017, http://www.cnn.eom/2017/06/14/homepage2/james-hodgkinson- 
profde/index.html. 
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3.4. Facebook Post to New York Police Officers 


On July 5, 2017, John Bonds shot and killed a New York eity poliee offieer as she 
sat in a eommand vehiele. Bonds posted a Faeebook Live video that eontains language 
against the poliee. As with the other three ease studies, this study looks at the posts 
through its language, the poster’s eriminal history, and eonfidenee seoring. 

The other studies eontained language in written posts. This ease study involves 
language posted to Faeebook through a video that was transmitted live and then saved as 
a post on the site. The Wall Street Journal reports that Bonds made the video around 
September 2016 and it eontained the following language: 

I’m not playing. Mister Offieer. I don’t eare about a hundred poliee 
watching this s—shit. You see this face. You see this face or anything, 
leave it alone. Trust and believe, [and] 

I’m not hesitating. It ain’t happening. Bond added. I wasn’t a b— bitch in 
jail, and I’m not going to be a b— bitch in the streets.^ 

Other comments from this video are documented by the Daily News as 

Y’all n-s so reluctant to want to say something to the police, man, Man, 

police is f-—ts, and this ain’t no gimmick. F—ts. [and] N-s ain’t 

taking it no more, Mr. Officer. I’m here to tell you, man. ... just keep your 
a— away from mine.3 

3.4.1 Social Media Monitoring and Language Sentiment 

While monitoring for keywords, the software, which would need to have the 
ability to translate speech, picks up the word police in Bond’s video. The whole video is 
very negative toward the police but does not contain any direct threats. It only commands 
police to leave Bonds alone. The software evaluates the text and produces a score. Table 
4 shows the sentence-by-sentence scoring, which is used to determine the overall score 
for the category. 


2 Phillips, Berman and Lowery, “I’m Not Playing Mr. Officer.” 

3 Adam Shrier, Graham Rayman, and Larry Mcshane, “NYPD Cop Killer Alexander Bonds Posted 
Anti-Police Facebook Rant,” Daily News, July 5, 2017, http://www.nydailynews.com/new-york/nyc- 
crime/suspected-nypd-shooter-assaulted-officer-brass-knuckles-article-1.3302356. 
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Table 4. Bond Post Sentiment'* 




Social Media Text 

Sentiment Value 

I’m not playing. Mister Officer 

2 

I don’t care about a hundred police watching 
this s—shit. 

2 

You see this face 

1 

You see this face or anything, leave it alone 

3 

Trust and believe 

0 

I’m not hesitating 

1 

It ain’t happening 

1 

I wasn’t a b— bitch in jail, and I’m not going 
to be a b— bitch in the streets 

3 

Y’all n-s so reluctant to want to say 

something to the police, man, 

Man, police is f-—ts, and this ain’t no gimmick 

3 

F—ts 

3 

N-s ain’t taking it no more, Mr. Officer. I’m 

here to tell you, man 

3 

just keep your a— away from mine 

4 


Since the post is located after an act of violence 10 months later, this study assumes the 
video is located shortly after its posting. Under these assumptions, a computed sentiment 
value returns a 2.2. This score passes to the confidence scoring software. 


4 Shrier, Rayman, and Mcshane, “NYPD Cop Killer Alexander Bonds Posted Anti-Police Facebook 
Rant,”; and Phillips, Berman, and Lowery, “I’m Not Playing, Mr. Officer.” 
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The difficulty of this study is that the violence took place 10 months after the 
video post. According to NBC New York, this video is followed by inspirational posts.^ 
The length of time with no other concerning posts may lower the negative sentiment 
score further as more and more inspirational posts come online. If the post is located soon 
after being put online, intervention may hopefully prevent this scenario. 

3.4.2 Criminal Background 

Bonds is easily recognized as the Facebook page owner. When his identity moves 
through databases for criminal records, his convictions show a robbery with a firearm, a 
drug violation, and an assault on an officer.^ Since it is unknown whether local law 
enforcement had Bond’s mental illness in its RMS, the system may or may not locate 
information on involuntary commitments (IVC). This case assumes that the software does 
not locate his mental diagnosis. Based on criminal history alone, a value of 6 is returned 
for Bonds. 


3.4.3 Confidence Scoring 

The language sentiment score and the criminal history score move to the 
confidence scoring section. In Bond’s example, the 2.2 from the sentiment score and the 
6 from the criminal history score are input into the confidence scoring algorithm, 
returning a score of 8.2 The threshold is predetermined a 5, so this case alerts 
investigators that they need to investigate further. 


5 Marc Santia, “Who is Alexander Bonds? Gunman Who Killed NYPD Cop Once Ranted Online 
About Treatment in Prison,” NBC New York, June 5, 2017, 

http://www.nbcnewyork.com/news/local/Alexander-Bonds-Gunman-NYPD-Officer-Shooting-Ambush- 

Bronx-432666103.html. 

^ Santia. 
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IV. IMPLEMENTATION ANALYSIS 


Law enforcement officers love new toys, which may take the form of new cars 
with cutting-edge LED lights, the latest RADAR unit, the fastest computer, or the newest 
technology software that helps officers solve cases. It may seem unusual for officers to be 
excited about software, but today’s law enforcement, whether assigned to patrol or 
detective work, uses technology constantly. If the officers perceive that software makes 
them better at solving their cases, they want to use it. Unfortunately, putting new 
software to use for law enforcement involves more than officers wanting it. Questions 
such as who uses the software, how it is used, how it improves job performance, and how 
it impacts citizens need answering. To show the vetting process prior to implementing a 
new piece of software, this chapter takes a look at the issue of case decisions made by 
software, the effects on citizen privacy, and the design obstacles for the threat-analysis 
software described in Chapter IV. 

A. CAN SOFTWARE HELP MAKE CASE DECISIONS? 

Software that makes decisions about what cases are investigated seems a bit 
unrealistic. The idea is not very far from current practice since decisions happen everyday 
on what gets investigated and what does not. Each jurisdiction is allocated a certain 
number of officers to investigate crimes. Each officer continues to receive cases most 
days of the week. Using Raleigh, North Carolina, as an example, a city with a population 
of around 450,000, close to 35,000 cases come in for investigation annually.^ There are 
approximately 100 investigators assigned to the detective division. If this caseload is 
divided equally among the 100 detectives, each detective receives 350 cases to 
investigate per year, each case requiring different amounts of time and resources. With 
this high case load, detectives must decide to which cases they dedicate the most effort 
Currently, investigators employ solvability factors to determine those cases. While these 

^ “Quickfacts,” United States Census Bureau, aeeessed July 8, 2017, 
https://www.eensus.gOv/quiekfaets/table/PST045216/3755000; and Raleigh Poliee Intelligenee Center, 
unpublished data, April 20, 2017. 
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solvability factors currently influence ease investigations, the advent of big-data opens 
the door to software making investigative decisions. To explore the question of whether 
this eoneept is feasible, this section discusses the eurrent use of solvability faetors and 
then data-driven deeisions. 

g 

Solvability factors are information and evidence that is available to solve a case. 
Urlaeher and Duffy provide the following 12 faetors, one of which must be present to 
solve a erime; 

• witnesses to the erime, 

• knowledge of the suspect’s name, 

• knowledge of where the suspeet ean be loeated, 

• deseription of suspeet, identifieation of suspeet, 

• property with traeeable, identifiable characteristics, marks or numbers, 

• existenee of a signifieant method of operation, 

• presenee of signifieant physieal evidenee, 

• deseription of the suspeet’s vehiele, 

• positive results from a erime scene evidence seareh, 

• belief that erime may be solved with publieity 

• reasonable additional investigative effort, 

• possibility and/or opportunity for anyone, other than the suspeet, to have 
eommitted the erime.^ 


The more factors investigators have, the higher the possibility of solving the case. Cases 
with a high probability of being solved are assigned for investigation. Cases that have no 
solvability faetors are not investigated. While not investigating a ease seems eallus, an 
investigator’s time is better spent working on oases that have a greater likelihood of 
ending in an arrest. All types of erime are reviewed for their solvability. Even a homioide 
investigation ends onoe the solvability factors end. Presently, eaoh offioer deoides 
whether a erime happened and whether it is solvable. 

Threat software employs this same deoision making as it evaluates threats over 
sooial media. Using language sentiment and oonfidenoe sooring, the software shows 
whioh threats are likely to cause violenoe. This equates to showing whioh language on 


^ Peter B. Bloeh and James Bell, Managing Investigations: The Rochester System (The Poliee 
Foundation, 1976), 45. 

^ Bloeh and Bell., 45. 
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social media rises to the statutory level of communicating a threat, satisfying the first step 
in erime investigation—ensuring a erime aetually happened. The ability of the software 
to learn over time increases its aecuracy, thus leading to officers bringing eharges for 
oases that have a high probability of ending in violenoe. This acouracy also helps offioers 
determine their solvability faotors. 

One of those faotors is the “reasonable additional investigatory effort.”'^’ For 
example, in a homioide ease, a department may find it reasonable to spend several 
thousand dollars for DNA analysis, while the same department may deoide that spending 
the same money for DNA analysis on a property erime investigation is unreasonable. 
Communioations of threat orimes are misdemeanors in most jurisdiotions and reoeive 
lower investigative priority. Investigating threats over sooial media requires additional 
teohniques suoh as obtaining oourt orders and interpreting IP information, eonflicting 
with the reasonable effort for the erime solvability faetor. Software identifying the likely 
threats based on data of past violence inereases the seriousness of the threat and justifies 
putting in the investigative effort. The Hodgkinson and Bond ease studies in the previous 
ehapters show how manual, subjeetive applieation of solvability factors may miss posts 
that end in violenee. When the software assists in loeating the threats, its alerts may allow 
early intervention. 

The process of the software may be eompared to the eurrent practiee of allowing 
eomputers to make deeisions for patrol alloeation. Predietive polieing software, such as 
Predpol, is an example of ageneies aeoepting the direction of resources by eomputer 
software.'^ Software, such as Predpol, analyzes data eontained in department RMS and 
CAD systems to determine, through proprietary algorithms, areas where offieers need to 
eoneentrate polieing efforts to prevent erime. These programs run automatieally after 
software administrators determine the period and eertain orimes they want the formulas to 
oonsider. Results show on a map as a square around a geographio area. Polioe supervisors 
direot resouroes to these areas, possibly leaving other areas untouohed or with less polioe 

Bloch and Bell, 45. 

^ ^ “Predpole is Predictive Policing,” Predpole, accessed July 8, 2017, http://www.predpol.com/about/. 

12 “Predpole is Predictive Policing.” 
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presence. The computer directing officers to patrol geographic regions equates to a 
computer telling a detective which threats to investigate. Machine learning lets the 
software refine its algorithms with better language and criminal history combinations that 
result in violence. An accurate threshold for the alert lets the software allocate only those 
threats with the highest potential for investigation. 

Allocating only the highest risk threats for investigation is important to agencies 
with limited resources, but not investigating threats is problematic as well. Threats 
usually communicate a violent act toward an individual. Deciding not to investigate one 
of these threats leaves the possibility of having to answer for why it was not investigated 
if violence does happen. Saying “the machine did not alert to that one” will not go over 
well with a victim’s family, leading to negative publicity and possible job repercussions. 
This is not a new problem as citizens already complain about how their individual cases 
are handled. Understanding how the software makes its recommendations and showing 
that its reliability is equal to or greater than a detective’s manual decisions are important 
for this reason. 

As illustrated in the preceding paragraphs, threat software is in line with current 
investigative practices and current uses of technology. Computers already help make 
deployment and investigative decisions for departments. This new software is consistent 
with current practices in that it searches for connections between people in hopes of 
identifying suspects, their associates, and related criminal histories to increase the 
accuracy of the confidence in risk of occurrence. These steps are now performed 
manually with the aid of online database search engines and with the confidence scoring 
done subjectively by investigators. The software reduces the subjectivity by using 
historical data to predict outcomes. As more data are input into the software, the accuracy 
and reliability should increase. Providing a consistent, reliable method for these 
investigations can ensure each is treated equally, reducing the claim that a certain threat 
was not considered. The claim is easily answered since the software considers all 
language but moves on to new posts once the last one is ruled out for a risk of violence. 

Now that the discussions show the software is in line with current practice, is the 

use of big data through data-driven decisions beneficial? Data-driven decisions are 
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13 

decisions based on information instead of using just your experience. Software lets 
these decisions happen by an automatic process, removing human subjectivity. Data 
collected over time helps predict future events. An example of this, as highlighted by 
Provost and Fawcett, is Walmart’s use of data from a previous hurricane to predict what 
items to sell before an upcoming storm makes landfall.'"^ In this case, the data predict 
human behavior. Companies that are leaders in their industries make 6 percent higher 
profits when they use big data to predict human behavior. McAfee and Bryonjolfsson 
make a correlation between these high data-driven decision companies to the fact each 
places the decision makers where they have access to the data.^^ Placing new software in 
case management decisions helps enhance decision making on threat case. The use of big 
data takes the intuition out of the investigator’s decision process. Instead, it uses the 
history of human behavior to guide investigative decisions. 

B. DOES THE SOFTWARE CHANGE CITIZEN INTERACTIONS? 

Social media and law enforcement conjure up an image of the National Security 
Agency collecting data from everyone’s Facebook pages and Twitter accounts. The 
perception of government collecting citizen data is unpopular. Companies that have 
provided services to the government to scan social media, such as Geofeedia, have lost 
their contracts with Facebook and Twitter when citizens learned how their information 
was being used.^’ Losing contracts does not mean law enforcement did anything illegal 
with the information. Facebook’s and Twitter’s decisions seem to be based on the fear of 
public outcry rather than law enforcement misusing the data. Since the topic of social 
media use by law enforcement is sensitive, any new software has to consider citizen 

Foster Provost and Tom Fawcett, “Data Science and its Relationship to Big Data and Data-Driven 
Decision Making,” Big Data 1, no.l (March 2013): 53, doi: 10.1089/big.2013.1508. 

1“^ Provost and Fawcett, 52. 

13 Andrew McAfee and Erik Brynjolfsson, “Big Data: The Management Revolution,” Harvard 
Business Review, (October 2012): 6, http://tarjomefa.eom/wp-content/uploads/2017/04/6539-Enghsh- 
T aij omeF a-1 .pdf 

1^ McAfee and Brynjolfsson, 8. 

1^ Lora Kolodny, “Facebook, Twitter Cut Off Data Access for Geofeedia, a Social Media Surveillance 
Startup,” Crunch Network, October 11, 2016, https://techcmnch.eom/2016/10/l 1/facebook-twitter-cut-off- 
data-access-for-geofeedia-a-social-media-surveillance-startup/. 
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privacy. Even though the use of soeial media information is legal, a positive pereeption 
surrounding the information use is essential. This seetion discusses how the threat 
software follows eurrent legal use of both social media and personal information and 
helps safeguard how the data are handled. 

The threat software incorporates tools already legally used by law enforcement. 
Law enforeement uses soeial analytie tools on a routine basis to analyze posts placed for 
public viewing. The analytic tools only speed up what an individual officer is able to do 
through manually viewing individual posts. The software allows more posts to be 
analyzed, but its use euts down on the number of sites actually viewed by law 
enforeement officers. 

The use of keywords and phrases allows the software to analyze social media 
language without law enforcement viewing each post. The software only returns those 
posts that contain the requested information. Looking at the case studies as examples, 
offieers keyed in words sueh as “kill,” “gun,” and “police.” These words would have 
returned B.K.’s and T.W.’s post. The use of these terms in a threat provides law 
enforeement reasonable suspieion to investigate the post for a erime. Identifying only 
posts with threatening language leaves the eitizen’s expectation of privacy intact. 

Identifying posts eontaining threatening language quicker also gives law 
enforeement intervention options other than arrest. Officers often talk to individuals 
dealing with life erisis. Often this is enough to prevent escalation. The other benefit is the 
offieer’s interactions may uncover other influenees on the person. One of these influenees 
is mental crisis. Officers ean work with the poster, the poster’s family and the eourt 
system to get the help needed to extract the person from the erisis. 

Another area of coneern with soeial media analytic tools is the eolleeting and 
retaining of data files on innoeent citizens. This is the complaint that citizens voiced after 
Snowden revealed how the NSA was using cell phone data. The threat software coneept 
ineludes coding that scans Lacebook and Twitter posts but does not provide those posts to 

Ewen Macaskill and Gabriel Dance, “NSA Files: Decoded,” The Gardian (November 1, 2013) 
https://www.theguardian.eom/world/interactive/2013/nov/01/snowden-nsa-fdes-surveillance-revelations- 
decoded#section/l. 
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law enforcement until the confidence threshold is triggered. At that point, the completed 
“package” of information that the software uses in its decision is made available to the 
investigator. The method would mean that only individuals whose posts rise to the level 
of reasonable suspicion are investigated. The program is coded to purge data on a routine 
basis to avoid collecting and retaining information on citizens not suspected of a criminal 
offense. This purge should not happen as soon as a post is viewed. This would mean 
missing posts such as Hodgkinson’s social media thread wherein a single post does not 
raise concern, but the continuation and escalation of language does. Purges based on a 
specified period help prevent law enforcement from missing concerning threads while 
reassuring citizens that a data file is not kept. Explaining the purging process and 
showing when it is scheduled may further ease concerns as citizens understand the 
benefit. This type of policy aligns with the way some law enforcement agencies are 
regulating their surveillance camera data. Raleigh, North Carolina, has a policy requiring 
that videos be purged every 90 days.'^ 

C. CAN THIS SOFTWARE REALLY BE DESIGNED AND 

IMPLEMENTED? 

Threat software identifies social media posts that pose the highest risk of violent 
results would benefit the law enforcement community. The goal of law enforcement is to 
protect life and property, so the hope is that locating more threats means there are fewer 
victims. The second benefit is higher efficiency for investigators while the third is 
maintaining citizen privacy. Implementing software to meet these three goals should save 
lives and increase law enforcement efficiency, but design and implementation obstacles 
do exist. Therefore, this section discusses how software calibration issues and 
information sharing need overcoming before a reliable product is released. 

Threat software needs historical and real-time data to accurately determine the 
combination of language sentiment and criminal history likely to end in violence. This 
data needs to include both threats that end in violence and those that never do. 
Fortunately for threat victims but unfortunately for the needs of the software, most threats 

Raleigh Police Department, Department Directives: Automated License Plate Recognition and 
Internet Protocol Camera Systems, 1110-07 (Raleigh, NC: Raleigh Police Department, 2016). 
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do not end in violence. As seen in the Raleigh incident in 2016, which contained case 
stories one and two, out of the multiple threats, none ended in violence. If the 
hypothetical software were to analyze data only from Raleigh, it could not adequately 
determine the risk for violence. Since most threats over social media in the Raleigh area 
do not end in violence, it would likely take years to obtain enough data to achieve 
reliability. This means the software needs access to data from multiple jurisdictions. The 
ability to obtain enough data is a problem of information sharing. 

Information sharing in law enforcement has gotten better since 9/11, but there is 
no consistent mechanism to share RMS and other case data. A lot of proximate agencies 
meet regularly and share crime information face to face. Common suspect information 
passes from one jurisdiction to another during these meetings. Copies of reports get 
handed over as paper copies. One reason for these meetings is each agency uses a 
different RMS, each with its own unique fields and none designed to interface with 
another RMS. As an example, the Raleigh Police Department uses Keystone while the 
Wake County Sheriffs office uses Sungard OSSI. There is no way to share data between 
the agencies except by hand-delivery or email. This just shows the difficulty in proximate 
agencies sharing data. If a nationwide sharing system is needed to obtain enough data to 
calibrate the software, the problem is obviously much larger. This problem is not too big 
to overcome. Although individual agencies are not developing ways to combine their 
data, private companies are. Lexis Nexis recently launched a service that allows agencies 
a secure way to share their data and run analytics across different agencies. Each 
organization has to choose whether it wants to pay to enter the service, so it is not a total 
solution but does show the ability to incorporate individual RMS into one database. 
Further research can show just how extensive information sharing needs to be to calibrate 
the software properly. 

After establishing a large enough data stream, calibration becomes the next 
obstacle. As seen in the case studies, the language with the most violent references but 
from individuals with no criminal histories did not end in violence while the language 
with the least violent references but offenders with a criminal history did end in violence. 
Because there is the potential for many different combinations of language and criminal 
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history, establishing the initial calibration is difficult. Machine learning can adjust to 
“training data,” so if enough data is obtained, this obstacle may be insignificant. This 
data should contain enough historical information to capture as many different 
combinations of language, criminal histories, and outcomes as possible. 

D. CONCLUSION 

June 12, 2017, started out normal enough for the Secret Service. 
Individual investigators went about working their cases. Some sat at their 
desks researching on computers, some went out to interview people 
involved in their cases, and others took calls from people concerned about 
cases or reporting suspicious people. Out of sight of the hustle and bustle 
of the office, a computer churned away, scanning social media feeds for 
threats against the president. Suddenly, the screen of the lonely computer 
came to life with a red, flashing banner. Investigators ’ phones buzzed and 
beeped simultaneously. Everyone stopped what they were doing to see 
what important alert had come through. The social media threat 
assessment tool alerted to a potential threat against Republican Party 
members. 

A report on the threat provides Special Agent Smith the details on the 
case. Facebook posts starting back in March 2017 consistently escalated 
negative language about President Trump and the Republican Party. The 
person posting had previously been charged with a violent crime in 
another state. While Hodgkinson has not directly threatened anyone, the 
software’s calculations setting off the alerts provide evidence that violence 
happens after people start posting similarly. SA Smith knows he can 
intervene by taking this case seriously. 

The investigative work of the case leads SA Smith to find that Hodgkinson 
is in the Washington, D.C., area. After partnering with local law 
enforcement, Hodgkinson is located at a local YMCA. SA Smith decides 
the best course of action is to interview Hodgkinson about his Facebook 
posts. During this interview, Hodgskinson presents signs of mental 
deterioration. SA Smith recognizes these signs and with the help of the 
rapport he establishes with Hodgkinson, gets resources lined up to help. 
Following up on the case over the next week finds Hodgkinson responding 
well, and he even returns home to Illinois. The violence that could have 
played out on June 14, 2017, never happens, and Hodgkinson continues to 
be an important part of his family. 


Bill Murdock, “How to Select a Threshold for Acting Using Confidence Scores.” 
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As seen earlier in the paper, this event ended with congressmen wounded and 
Hodgkinson dead. There is no guarantee that a machine or a human could have prevented 
the shooting on June 14, 2017. However, the proposed social media threat assessment 
tool has the potential to help law enforcement intervene in a case much earlier, protecting 
both the victim and the suspect from tragic outcomes. 
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